Issue #214: Add security checks for packages installing systemd unit files - FedoraReview

FedoraReview

#214 Add security checks for packages installing systemd unit files

Closed: Fixed Opened May 2, 2013 by sochotni.

We could use checksec script[1] or something similar to check if full RELRO and other security compile-time features have been enabled.

It would probably result in dependency on the script, but we can make it soft-dep easily (I am thinking a shell script plugin instead of full-fledged python)

[1] http://www.trapkit.de/tools/checksec.html

pwouters commented May 2, 2013

Specifically, anything that is started with ExecStart= (and possibly ExecStartPre=) should be hardened and pass the checksec checks.

sochotni commented May 2, 2013

Replying to [comment:1 pwouters]:

Specifically, anything that is started with ExecStart= (and possibly ExecStartPre=) should be hardened and pass the checksec checks.

Well those can be shell scripts in some cases. I wouldn't mind checking everything in /*bin. Better safe than sorry. Not to mention It will probably be easier to run it unconditionally on all binaries if .unit file exists in the package

leamas commented May 6, 2013

We don't really know version of next release. Moving to future

leamas commented May 10, 2013

This is indeed an enhancement

leamas commented May 10, 2013

We'd need to package that script (having an upstream) before using it in f-r.

leamas commented May 10, 2013

See also bug #193, another attempt on this

leamas commented Sep 2, 2013

Fixed in 8b93c154208c6a6ff896e6d942